root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(FN-4638): tighten network bind scope and add fusion guard regressions

Browse Source 
Fusion-Task-Id: FN-4638
Fusion-Task-Lineage: a6dcc3d9-b7ab-42c1-af88-c9e09f770d92
This commit is contained in:
Fusion
2026-05-15 11:11:44 -07:00
committed by gsxdsm
parent ba54957777
commit 08dd73ee1e
2 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
packages/engine/src/__tests__/sandbox/sandbox-exec-policy.test.ts
View File

@@ -51,12 +51,12 @@ describe("sandbox-exec policy", () => {
expect(() => policyToSbplProfile({ allowNetwork: true, allowedPorts: [4040] }, ctx)).toThrow(SandboxPolicyError);
});
it("guards fusion writes", () => {
it.each(["/tmp/repo/.fusion/tasks", "/tmp/repo/.fusion/fusion.db"])("guards fusion writes for %s", (writePath) => {
expect(() =>
policyToSbplProfile(
{
allowNetwork: true,
allowedWritePaths: ["/tmp/repo/.fusion/tasks"],
allowedWritePaths: [writePath],
},
ctx,
),
@@ -67,6 +67,10 @@ describe("sandbox-exec policy", () => {
const profile = policyToSbplProfile(fusionWorktreePreset(ctx), ctx);
expect(profile).toContain("(allow file-write* (subpath \"/tmp/worktree\"))");
expect(profile).toContain("(allow file-write* (subpath \"/Users/test/Library/pnpm/store\"))");
expect(profile).toContain("(allow file-read* (subpath \"/usr\"))");
expect(profile).toContain("(allow file-read* (subpath \"/tmp/repo\"))");
expect(profile).toContain("(allow file-read* (subpath \"/usr/local/bin\"))");
expect(profile).toContain("(allow file-read* (subpath \"/private/var/folders\"))");
expect(profile).toContain("(deny network-bind (local ip \"*:4040\"))");
});
});

3
packages/engine/src/sandbox/sandbox-exec-profile-templates.ts
View File

@@ -22,6 +22,7 @@ export const SBPL_FILE_READ_BASE = `
(allow file-read* (subpath "/private/var/db/timezone"))
(allow file-read* (literal "/private/etc/hosts"))
(allow file-read* (literal "/private/etc/services"))
(allow file-read* (subpath "/private/var/folders"))
`;
export const SBPL_TMP_WRITE = `
@@ -32,7 +33,7 @@ export const SBPL_NETWORK_DENY_ALL = `(deny network*)`;
export const SBPL_NETWORK_ALLOW_OUTBOUND = `
(allow network-outbound)
(allow network-bind)
(allow network-bind (local ip))
(allow system-socket)
(deny network-bind (local ip "*:4040"))
`;